CVE-2026-1728 — Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover
Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability all…
Published: 2026-08-06 · CVSS: 9.8 · CVSS 3.1
Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative account takeover. This requires the attacker to already possess a low-privileged user account and be able to obtain a valid token for it.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7